Quoting Seth Larson

The Python Package Index (PyPI) has introduced a significant security restriction aimed at protecting the Python ecosystem from supply chain attacks. Starting immediately, PyPI will reject any new file uploads to releases that are more than 14 days old. This protective measure represents a critical evolution in how the largest Python package repository safeguards millions of developers and projects worldwide.

The new upload restriction policy took effect to address vulnerabilities in project maintenance workflows. Under this system, developers can no longer add files to older releases, which prevents attackers from exploiting compromised publishing tokens or automated workflows to inject malicious code into long-established, stable versions that developers may rely upon for production systems. The 14-day window provides a reasonable grace period for legitimate use cases while substantially reducing the attack surface for malicious actors targeting dormant but widely-used package versions.

• Enhanced supply chain security: Reduces the window of vulnerability for compromised credentials by preventing retroactive poisoning of stable releases
• Workflow adjustments required: Development teams must adapt their release processes to accommodate the new restrictions on legacy version updates
• Increased confidence in dependencies: Provides greater assurance that downloaded packages haven't been modified after initial publication
• Potential edge cases: May inconvenience edge cases where legitimate patches are needed for older releases, requiring version bumps instead
• Industry precedent: Establishes stricter standards for package repositories and may influence security practices across other language ecosystems

As software supply chain attacks continue to increase in sophistication and frequency, PyPI's proactive approach addresses one of the most dangerous attack vectors in modern software development. By implementing this restriction, PyPI protects not just individual developers but entire organizations that depend on Python packages for critical infrastructure. This measure acknowledges that preventing attackers from compromising old releases is more valuable than maintaining complete flexibility in the upload process, striking a balance between security and practical usability that benefits the entire Python community.